A financial enterprise is designing a centralized log routing architecture to stream security telemetry across hundreds of Google Cloud projects to an external Security Information and Event Management (SIEM) system. The security engineering team has defined the following requirements: Automatically aggregate Admin Activity audit logs, System Event logs, VPC Flow Logs, and Data Access audit logs across all existing and future folders and projects in the Google Cloud organization. Filter out high-volume, low-fidelity Data Access audit events (specifically Cloud Storage object get and list operations) and routine maintenance events before exporting them to reduce external SIEM ingestion costs. Maintain centralized administration without requiring per-project log router sink management. Which architecture should the team implement to meet these requirements?

Create an aggregated log sink at the organization level with the includeChildren parameter enabled, configure an inclusion filter for the required log IDs, and define exclusion filters for the routine Cloud Storage operations and maintenance events.: ### What Aggregated Log Sinks and Filter Rules Are An **aggregated log sink** configured at the Google Cloud organization level combines and routes log entries from the organization and all its child folders, billing accounts, and projects. By utilizing the `includeChildren` parameter alongside **Logging query language** inclusion and exclusion filters, security teams can centrally govern telemetry pipelines, ensuring comprehensive visibility while controlling downstream data volumes and costs. ### How It Meets the Requirements - **Organization-wide aggregation across all projects:** Setting the log sink at the organization root with `includeChildren = true` (or `--include-children` via `gcloud`) ensures that log telemetry from all existing and dynamically provisioned child folders and projects is routed automatically without per-project configuration. - **Selectively routing high-fidelity security telemetry:** The sink's inclusion filter explicitly targets desired log IDs, including `cloudaudit.googleapis.com/activity`, `cloudaudit.googleapis.com/system_event`, `compute.googleapis.com/vpc_flows`, and `cloudaudit.googleapis.com/data_access`. - **Filtering out high-volume and routine events:** Configuring exclusion filters on the sink (such as matching `protoPayload.methodName =~ "^storage\.(buckets|objects)\.(get|list)$"` and `LOG_ID("maintenance.googleapis.com/maintenance_events")`) discards low-fidelity entries immediately after ingestion, preventing costly streaming to the destination SIEM. - **Centralized administration:** Managing a single aggregated sink at the organization level eliminates configuration drift and administrative overhead across individual project log routers. ### Key Advantages and Capabilities - **Dynamic discovery:** Automatically captures logs from new projects as soon as they are created under the resource hierarchy. - **Deterministic evaluation order:** Cloud Logging first validates the inclusion filter; if a log matches the inclusion criteria and does not match any exclusion rule, it is forwarded to the designated export destination. - **Granular exclusion limits:** Supports up to 50 exclusion filters per sink, with query lengths up to 20,000 characters, allowing fine-grained tuning of noisy APIs. - **Direct SIEM integration:** Routes filtered streams directly to external endpoints, Pub/Sub topics, or Cloud Storage buckets for downstream ingestion. ### Why This Is Optimal This solution provides unified security governance and least-privilege administrative boundaries. It prevents operational silos, guarantees that developers cannot bypass or disable audit logging at the project level, and optimizes external SIEM ingestion costs by discarding non-actionable read/list telemetry before egress.

Aggregated Log Sinks Siem Export | Professional Cloud Security Engineer

Aggregated Log Sinks Siem Export

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing a centralized log routing architecture to stream security telemetry across hundreds of Google Cloud projects to an external Security Information and Event Management (SIEM) system.

The security engineering team has defined the following requirements:

Automatically aggregate Admin Activity audit logs, System Event logs, VPC Flow Logs, and Data Access audit logs across all existing and future folders and projects in the Google Cloud organization.
Filter out high-volume, low-fidelity Data Access audit events (specifically Cloud Storage object get and list operations) and routine maintenance events before exporting them to reduce external SIEM ingestion costs.
Maintain centralized administration without requiring per-project log router sink management.

Which architecture should the team implement to meet these requirements?

Deploy individual project-level sinks across all existing projects routing to the external SIEM, and modify the _Required and _Default sinks in each project to add the exclusion filters.

Create an aggregated log sink at the organization level with the includeChildren parameter enabled, configure an inclusion filter for the required log IDs, and define exclusion filters for the routine Cloud Storage operations and maintenance events.

Create an aggregated log sink at the organization level with the includeChildren parameter disabled, and modify the organization-level _Required sink to forward child project logs to the destination SIEM.

Create an aggregated log sink at the organization level with an empty inclusion filter, and revoke Data Access IAM permissions from service accounts to prevent noisy logs from being generated.

Professional Cloud Security Engineer

Aggregated Log Sinks Siem Export

Related questions